Encrypt Azure SQL Data at Rest, In Transit, and In Use — Always Encrypted + TDE + TLS
You are designing a secure database solution for a financial application using Azure SQL Database. The database contains highly sensitive columns (e.g., credit card numbers). Which combination of features should you implement to protect data at rest, in transit, and in use, while minimizing performance impact?
Quick Answer
The correct combination is Always Encrypted, TDE, and enforced TLS 1.2, because this layered approach addresses all three data states: Always Encrypted protects sensitive columns like credit card numbers in use and at rest on the server by keeping encryption keys client-side, TDE encrypts the entire database at rest transparently, and TLS 1.2 secures data in transit between the application and database. On the AZ-500 exam, this scenario tests your understanding that Dynamic Data Masking only obfuscates output without encryption, and that Always Encrypted with enclaves, while enabling richer queries, introduces performance overhead that may not be necessary for simple equality searches. A common trap is assuming column-level encryption alone covers at-rest protection, but it does not—TDE is required for that. Memory tip: think “TDE for the whole file, Always Encrypted for the sensitive cells, TLS for the wire.”
⚠ Common exam trap
It's easy for candidates to confuse Dynamic Data Masking with encryption, thinking it protects data in use, when in fact it only masks output and does not encrypt data at rest or in transit, leaving it vulnerable to privileged users or direct database access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Always Encrypted (with deterministic encryption for equality searches), TDE, and enforce TLS 1.2.
It combines Always Encrypted with deterministic encryption (which supports equality searches while protecting data in use), Transparent Data Encryption (TDE) for data at rest, and enforced TLS 1.2 for data in transit. This provides comprehensive protection across all three states while minimizing performance impact, as deterministic encryption allows efficient querying without decrypting on the server side.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Always Encrypted with secure enclaves, TDE, and enforce TLS 1.2.
Why it's wrong here
While this provides richer computations, it may have performance impact and is not strictly necessary for basic protection.
- ✗
Dynamic Data Masking, TDE, and enforce TLS 1.2.
Why it's wrong here
Dynamic Data Masking does not encrypt data; it only masks output.
- ✓
Always Encrypted (with deterministic encryption for equality searches), TDE, and enforce TLS 1.2.
Why this is correct
Always Encrypted protects data in use and at rest on the server; TDE encrypts at rest; TLS enforces in-transit encryption.
- ✗
Column-level encryption using Azure Key Vault, TDE, and enforce TLS 1.2.
Why it's wrong here
Column-level encryption is not native to Azure SQL; Always Encrypted is the recommended approach.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are designing a secure data solution for a financial application. The data must be encrypted at rest, in transit, and in use. You choose Azure SQL Database. Which combination of features should you implement?
hard- ✓ A.Transparent Data Encryption, enforce TLS, and Always Encrypted
- B.Azure Information Protection, Dynamic Data Masking, and column-level security
- C.Always Encrypted, Azure Active Directory authentication, and Azure Information Protection
- D.Transparent Data Encryption, Dynamic Data Masking, and Azure Active Directory authentication
Why A: It addresses all three encryption states required by the scenario: Transparent Data Encryption (TDE) encrypts data at rest, enforcing TLS secures data in transit, and Always Encrypted protects data in use by keeping encryption keys client-side, ensuring plaintext data never appears in the database engine.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.